Wikimedia Bugzilla is closed!

Hi,

I've been able to reproduce this on MW 1.8.3. If your wiki configuration allows
regular users on a wiki to be able to rollback edits, they are able to rollback
edits on protected pages, even though they can't directly edit them. 

I fixed this on our site by changing Article:rollback by adding: 


        if ( ! $this->mTitle->userCanEdit() ) {
            wfDebug( "$fname: user can't edit\n" );
            $wgOut->readOnlyPage( $this->mArticle->getContent(), true );
            wfProfileOut( $fname );
            return;
        }

to the function rollback and changing in DifferenceEngine.php on line 150 from: 

 if ( $this->mNewRev->isCurrent() && $wgUser->isAllowed('rollback') ) {

to

 if ( $this->mNewRev->isCurrent() && $wgUser->isAllowed('rollback') &&
$this->mTitle->userCanEdit()) {